Last updated: November 4, 2026 · Reading time: 8–11 minutes
Wazuh vs. Elastic: Both collect logs, detect suspicious activity, and can be self-hosted. The real difference lies in where the analysis takes place and what data you can search later. This comparison highlights architecture, feature sets, costs, and operational overhead.
Wazuh vs. Elastic: Key Points at a Glance
- Wazuh analyzes events in the Manager and, by default, stores only alerts. Elastic stores the raw data in the index, where you can still search for it even weeks later.
- Wazuh offers more without any licensing costs: vulnerability scanning, CIS checks, inventory, file integrity monitoring, and compliance reports are all completely free.
- Elastic Security is more advanced in terms of analysis, query languages, and EDR, but you’ll need a paid license for machine learning and many response actions.
- A small Wazuh server runs for a long time with little maintenance, while an Elastic cluster handling large volumes of data requires regular attention. You can also combine the two.
The question comes up again and again: Wazuh or Elastic? At first glance, the two seem almost interchangeable. But if you take a closer look, you’ll quickly realize that they come from very different backgrounds. I took a look at how they work, how much they cost, and what it means to use them on a day-to-day basis.
How are Wazuh and Elastic related?
Wazuh used to run directly on the Elastic Stack, with Elasticsearch for storage and search and Kibana as the user interface. In early 2021, Elastic switched the license from Apache 2.0 to SSPL and the Elastic License. As a result, Wazuh switched to OpenSearch in 2022 with version 4.3—the fork that Amazon built from the latest Apache version of Elasticsearch. Since 2024, Elasticsearch has also been available under the AGPL, making it officially open source once again.
Today, Wazuh consists of Manager, Indexer, and Dashboard. Indexer and Dashboard are customized versions of OpenSearch and OpenSearch Dashboards. Technically, the two are quite closely related.
There is, however, one difference in the basic principle that plays a major role in day-to-day use. With Wazuh, evaluation takes place on the manager, and by default, only the finalized alerts end up in the indexer. With Elastic, the raw data goes into the index, and the detection rules run as regular queries directly on it. This means that with Elastic, you can still search through all events even weeks later. With Wazuh, this is only possible if you’ve enabled the archive; otherwise, you’ll only see what triggered a rule.
As a Wazuh Platinum Partner , we ’re happy to guide you through the entire process—from selection to implementation—no matter which of the two SIEMs you choose.
Free Initial Consultation →
Wazuh: A lot happens directly on the host
With Wazuh, the agent does a large part of the work. It monitors files for changes, checks the configuration against CIS benchmarks, records installed packages and open ports, and compares all of this against known vulnerabilities. If you want, Wazuh can also take action on its own—for example, by blocking an IP address that’s currently launching a brute-force attack.
On the manager, the data passes through decoders and rules, both of which are in XML. This may seem a bit old-fashioned at first, but it’s easy to understand and can be easily extended.
I find the compliance mappings really handy. Many rules are already mapped to PCI DSS, GDPR, HIPAA, or NIST. If an audit is coming up, this gives you a solid foundation.
Elastic Security: One Platform for Everything
You don’t install Elastic Security separately. It’s part of the Elastic platform. Data comes in via the Elastic Agent—which you manage centrally through Fleet—or through one of the many integrations.
For detection, Elastic comes with over 1,000 pre-built rules; you can write your own in KQL, EQL, or ES|QL. Elastic really shines when it comes to investigation. For example, if a rule is triggered by an unusual login, you can open the alert in a timeline. There, you can see which processes were started on the host afterward and where they established connections—provided that Elastic Defend or Sysmon provide this data. If it’s a genuine incident, it becomes a case that you can work on with your colleagues. Elastic Defend itself is an EDR that not only reports malware and ransomware but also blocks them.
For some time now, Elastic has been placing a strong emphasis on AI. The AI Assistant and workflows are designed to automate triage and response, which would eliminate the need for a separate SOAR tool. I haven’t tested whether this is actually sufficient in practice. It’s especially interesting if you’re already using Elastic for logs or monitoring.
How much do Wazuh and Elastic cost?
Wazuh: completely open source
Wazuh is open source under the GPLv2—and truly 100% open source. There is no Enterprise Edition with additional features. Wazuh generates revenue through support and Wazuh Cloud, the hosted version. Online, you can find prices starting at around $571 per month for up to 100 agents. However, the figures vary, so if in doubt, check directly with Wazuh.
Elastic: Basic Tier, Licenses, and Cloud
With Elastic, things get a little more complicated. The Basic tier is free for self-hosted deployments, and it offers quite a few features. However, for machine learning or the advanced response features, you’ll need a Platinum or Enterprise license. You can only find out how much those cost by contacting sales.
In the cloud, you can choose between Hosted and Serverless. With Hosted, you pay for your cluster’s resources; with Serverless, you pay based on data volume. In the Essentials tier, prices start at $0.09 per GB for ingestion and $0.017 per GB per month for storage; in the Complete tier, they’re slightly higher. The per-endpoint fee was eliminated in March 2026. Support costs up to 15% extra, depending on the tier.
However, these are entry-level prices that are often tied to a minimum volume. For small environments, you should plan to spend a bit more.
Host Wazuh and Elastic Yourself
You can run both yourself. I set up both of them once following the official instructions on their respective websites, and the difference is immediately apparent.
Installing Wazuh
With Wazuh, you download an installation script and run it using the all-in-one installation option. The script installs the indexer, manager, and dashboard on a single machine, generates the certificates, and provides you with the admin password at the end. After that, you log in to the Dashboard and can start adding your first agents. A single VM is often sufficient for a few hundred agents. Alternatively, there’s an OVA, Docker Compose, and Kubernetes manifests. You won’t need to seriously deal with the Indexer until your environment grows.
Installing Elastic
At Elastic There are significantly more individual steps involved. First, you install Elasticsearch, which—since version 8—secures itself with TLS upon first launch and provides you with the password for the `elastic` user as well as an enrollment token. You then use that token to connect Kibana. However, you don’t have a SIEM yet. For the agents, you’ll also need a Fleet Server; only then can you roll out Elastic Agents with the integration for Elastic Defend. This is well documented, but the instructions are spread across several pages of the documentation. Instead of using packages, you can also install Elastic on Kubernetes using Docker or ECK.
Operational costs
But the real work begins once the system is up and running. The index lifecycle policies must be tailored to the data volume; otherwise, either the storage will fill up, or old data will disappear sooner than expected. Too many small shards slow down the cluster, while shards that are too large make recovery and rebalancing cumbersome. And a snapshot is only truly valuable once you’ve actually tried restoring from it. With several hundred GB per day, you’ll need someone who really knows Elasticsearch.
The same applies to the Wazuh indexer. But because it typically only handles alerts, such problems usually don’t become apparent until much later.
Are you planning to set up a SIEM using Wazuh or Elastic?
We support projects using both systems, from selection and setup through to operation.
Learn More About SIEM & Threat Detection →
Wazuh vs. Elastic: Which One Offers More?
With Wazuh, you get more without any licensing costs. Vulnerability scanning, CIS checks, inventory, file integrity monitoring, and compliance reports are all included in the free version. With Elastic, the Basic Tier does include SIEM and Elastic Defend, but you’ll have to pay for machine learning, many response actions, and some automation features.
If you look at what’s technically possible overall, the picture is different. With ES|QL and EQL, you can get significantly more out of your data; the EDR capabilities are more advanced, and the list of integrations is longer. If you want to have security and observability on a single platform anyway, there’s really no getting around Elastic.
You don’t necessarily have to choose one or the other. Some people use Wazuh agents for host data and send everything to Elastic for analysis. Elastic even has its own Wazuh integration for this purpose.
Wazuh vs. Elastic: A Head-to-Head Comparison
| Criterion | Wazuh | Elastic Security |
|---|---|---|
| License | GPLv2, fully open source | Elasticsearch under AGPL, SSPL, and the Elastic License; Basic Tier is free, Platinum and Enterprise are paid plans |
| Components | Agent, Manager, Indexer, and Dashboard (Indexer and Dashboard are based on OpenSearch) | Elasticsearch, Kibana, Fleet Server, and Elastic Agent |
| Analysis | On the Manager, Decoder, and rules in XML | Detection Rules as regular queries on the raw data |
| Stored Data | By default, only alerts; all events are stored only if archiving is enabled | Raw data in the index, searchable even weeks later |
| Rules and Queries | Ruleset with Compliance Mappings (PCI DSS, GDPR, HIPAA, NIST) | Over 1,000 predefined rules; create your own in KQL, EQL, or ES|QL |
| Endpoint | File integrity monitoring, CIS checks, inventory, vulnerabilities, automated responses such as IP blocking | Elastic Defend as EDR, blocks malware and ransomware |
| No licensing costs | Full feature set | SIEM and Elastic Defend; machine learning, many response actions, and some automation features require a fee |
| Cloud | Wazuh Cloud | Elastic Cloud Hosted or Serverless |
| Installation | All-in-one script, OVA, Docker Compose, or Kubernetes | Packages, Docker, or ECK; multiple steps, including Fleet Server |
| Operating Expenses | A small server runs for a long time with minimal maintenance | With large data volumes, regular maintenance is required (ILM, shards, snapshots) |
With no licensing costs, Wazuh offers a broader range of features and generally requires less effort to maintain. Elastic Security is more advanced in terms of investigation, query languages, and EDR, but requires a paid license for some features and more support as data volumes grow.
Decision Guide: When is Wazuh the right choice, and when is Elastic?
| If you want to actively stop attacks at the endpoint, use Elastic with Elastic Defend or a separate EDR solution. Wazuh can’t do that to this extent. |
| If you’re focused on hardening, vulnerabilities, and audit evidence, go with Wazuh. CIS checks, vulnerability scans, and compliance mappings are included at no additional license cost, so you’ll often be up and running faster. |
| If your team has limited time for operations, use Wazuh or Elastic in the cloud. A small Wazuh server can run for a long time with little maintenance, while a self-hosted Elastic cluster handling large volumes of data requires regular attention. Alternatively, you can move Elastic to the cloud and pay for it. |
| If you want to be able to search through all events even weeks later, go with Elastic. With Elastic, the raw data is stored in the index; with Wazuh, this is only possible if the archive feature is enabled. |
| If you’re already running Elastic for logs, go with Elastic Security. You’ll already have the expertise and infrastructure in place, so it’s a small step. |
Conclusion: When is Wazuh the right choice, and when is Elastic?
Which system is a better fit depends mainly on what you need. If you want an EDR to actively stop attacks on the endpoint, you’ll end up with Elastic Defend or a separate EDR. Wazuh can’t do that to that extent. If you’re more concerned with hardening, vulnerabilities, and audit evidence, you’ll often be up and running faster with Wazuh.
Then there’s the question of how much time your team has to manage it. A small Wazuh server can run for a long time with minimal maintenance, whereas an Elastic cluster handling large volumes of data requires regular attention. Alternatively, you can move it to the cloud and pay for it. And if you’re already using Elastic for logs, you have the expertise and infrastructure in place, so the step up to Elastic Security is a small one.
You can test Wazuh for free; Elastic offers a trial period. It’s best to use real data from your own environment for this.
